Privacy Policy

1. DATA CONTROLLER The data controller for personal data processed through the GuitarSpace application is the music school operating the Application ("Controller"). The Controller processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Latvian Personal Data Processing Law (Fizisko personu datu apstrādes likums). 2. DATA WE COLLECT 2.1. Account data: first name, last name, email address, password (stored in hashed form). 2.2. Profile data: phone number (optional), profile picture (optional), musical instruments. 2.3. Education data: lesson records, attendance, schedules, educational materials, teacher-student relationships. 2.4. Communication data: messages exchanged through the in-app chat system. 2.5. Payment records: lesson payment tracking data (amounts, dates, status). The Application does not process actual financial transactions or store payment card information. 2.6. Technical data: device information, app version, and usage logs necessary for the operation of the service. 3. LEGAL BASIS FOR PROCESSING 3.1. Contract performance (GDPR Art. 6(1)(b)): Processing necessary to provide the music education management service you have registered for. 3.2. Consent (GDPR Art. 6(1)(a)): Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. 3.3. Legitimate interests (GDPR Art. 6(1)(f)): Service improvement, security, and fraud prevention. 4. CHILDREN'S DATA 4.1. The Application may process personal data of children (minors under 18) who are students at the music school. 4.2. In accordance with GDPR Article 8 and Latvian law, the minimum age for digital consent is 13 years. For users under 13, a parent or legal guardian must provide consent and manage the account. 4.3. For users aged 13–18, parental or guardian consent is required for account creation. The school administration is responsible for verifying that appropriate parental consent has been obtained before adding minor students to the system. 4.4. We process children's data solely for the purpose of music education management. We do not use children's data for marketing, profiling, or any purpose unrelated to their education. 4.5. Parents and legal guardians have the right to: a) Access their child's personal data; b) Request correction or deletion of their child's data; c) Withdraw consent for data processing; d) Object to any processing of their child's data. 5. DATA SHARING 5.1. Within the school: Your data is visible to school administrators and, where relevant for educational purposes, to your teachers or students. 5.1.1. Chats: for the safety of students, many of whom are children, the school's administrators can read the school's in-app chats (teacher–student and group chats), including ones they do not take part in. Their reading does not mark messages as read, and every such access is logged. 5.2. We do not sell personal data to third parties. 5.3. We may share data with: a) Infrastructure providers (hosting, cloud storage) who process data on our behalf under data processing agreements; b) Law enforcement or regulatory authorities when required by law. 6. DATA TRANSFERS 6.1. Personal data is primarily stored on servers within the European Economic Area (EEA). 6.2. If data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission. 7. DATA RETENTION 7.1. Account data is retained for the duration of your active account and for up to 12 months after account deletion for legal and administrative purposes. 7.2. Communication data (chat messages) is retained for the duration of the active account. 7.3. Payment tracking records are retained for 7 years after creation to comply with Latvian tax and accounting legislation. 7.4. Upon request for deletion, we will anonymize or delete personal data within 30 days, except where retention is required by law. 8. YOUR RIGHTS Under GDPR, you have the following rights regarding your personal data: 8.1. Right of access (Art. 15): You may request a copy of your personal data. 8.2. Right to rectification (Art. 16): You may request correction of inaccurate data. 8.3. Right to erasure (Art. 17): You may request deletion of your data ("right to be forgotten"), subject to legal retention requirements. 8.4. Right to restriction (Art. 18): You may request restriction of processing in certain circumstances. 8.5. Right to data portability (Art. 20): You may request your data in a structured, machine-readable format. 8.6. Right to object (Art. 21): You may object to processing based on legitimate interests. 8.7. Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time. 8.8. Right to lodge a complaint: You may file a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija): Address: Elijas iela 17, Riga, LV-1050, Latvia Website: www.dvi.gov.lv Email: pasts@dvi.gov.lv 9. DATA SECURITY 9.1. We implement appropriate technical and organizational measures to protect personal data, including: a) Encryption of data in transit (TLS/SSL); b) Secure password hashing (bcrypt); c) Access controls and authentication; d) Regular security reviews. 10. COOKIES AND TRACKING 10.1. The Application is a mobile application and does not use browser cookies. 10.2. We do not use third-party advertising trackers or analytics that profile users. 11. CHANGES TO THIS POLICY 11.1. We may update this Privacy Policy from time to time. Material changes will be communicated through the Application. 11.2. Continued use of the Application after changes constitutes acceptance of the updated policy. 12. CONTACT For any questions about this Privacy Policy or to exercise your data protection rights, contact your school administrator or the Application operator. For data protection inquiries specifically, you may also contact the Latvian Data State Inspectorate (Datu valsts inspekcija) at pasts@dvi.gov.lv.